[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
payload (source)	^2.0.0 → ^3.0.0

---

Payload does not invalidate JWTs after log out

CVE-2025-4643 / GHSA-5v66-m237-hwf7

More information

Details

Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to freely reuse it until expiration date (which is by default set to 2 hours, but can be changed).

This issue has been fixed in version 3.44.0 of Payload.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-4643
• https://cert.pl/en/posts/2025/08/CVE-2025-4643
• https://github.com/payloadcms/payload
• https://github.com/payloadcms/payload/commit/26d709dda6e512ce347557eaa2057db6e0cbf809
• https://github.com/advisories/GHSA-5v66-m237-hwf7

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Payload's SQLite adapter Session Fixation vulnerability

CVE-2025-4644 / GHSA-26rv-h2hf-3fw4

More information

Details

A Session Fixation vulnerability existed in Payload's SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new account, save its JSON Web Token (JWT), and then delete the account, which did not invalidate the JWT. As a result, the next newly created user would receive the same identifier, allowing the attacker to reuse the JWT to authenticate and perform actions as that user.

This issue has been fixed in version 3.44.0 of Payload.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-4644
• https://cert.pl/en/posts/2025/08/CVE-2025-4643
• https://github.com/payloadcms/payload
• https://github.com/payloadcms/payload/commit/26d709dda6e512ce347557eaa2057db6e0cbf809
• https://github.com/advisories/GHSA-26rv-h2hf-3fw4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments)

CVE-2026-25574 / GHSA-jq29-r496-r955

More information

Details

Impact

A cross-collection Insecure Direct Object Reference (IDOR) vulnerability exists in the payload-preferences internal collection. In multi-auth collection environments using Postgres or SQLite with default serial/auto-increment IDs, authenticated users from one auth collection can read and delete preferences belonging to users in different auth collections when their numeric IDs collide.

Users are affected if ALL of these are true:

• Multiple auth collections configured (e.g., admins + customers)
• Postgres or SQLite database adapter with serial/auto-increment IDs
• Users in different auth collections with the same numeric ID

Not affected:

• @payloadcms/db-mongodb adapter
• Single auth collection environments
• Postgres/SQLite with idType: 'uuid'

Patches

This vulnerability has been patched in v3.74.0. Users should upgrade to v3.74.0 or later.

Workarounds

There is no workaround other than upgrading. Users with multiple auth collections using Postgres or SQLite with serial IDs should upgrade immediately.

Severity

• CVSS Score: 5.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

• https://github.com/payloadcms/payload/security/advisories/GHSA-jq29-r496-r955
• https://nvd.nist.gov/vuln/detail/CVE-2026-25574
• https://github.com/advisories/GHSA-jq29-r496-r955

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Payload: Server-Side Request Forgery (SSRF) in External File URL Uploads

CVE-2026-27567 / GHSA-hhfx-5x8j-f5f6

More information

Details

Impact

A Server-Side Request Forgery (SSRF) vulnerability exists in Payload's external file upload functionality. When processing external URLs for file uploads, insufficient validation of HTTP redirects could allow an authenticated attacker to access internal network resources.

Users are affected if ALL of these are true:

• Payload version < v3.75.0
• At least one collection with upload enabled
• A user has create access to that upload-enabled collection

An authenticated user with upload collection write permissions could potentially access internal services. Response content from internal services could be retrieved through the application.

Patches

This vulnerability has been patched in v3.75.0. Users should upgrade to v3.75.0 or later.

Workarounds

If users cannot upgrade immediately, they can mitigate this vulnerability by disabling external file uploads via the disableExternalFile upload collection option, or by restricting create access on upload-enabled collections to trusted users only.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

References

• https://github.com/payloadcms/payload/security/advisories/GHSA-hhfx-5x8j-f5f6
• https://nvd.nist.gov/vuln/detail/CVE-2026-27567
• https://github.com/payloadcms/payload/commit/1041bb6
• https://github.com/payloadcms/payload/releases/tag/v3.75.0
• https://github.com/advisories/GHSA-hhfx-5x8j-f5f6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery

CVE-2026-34751 / GHSA-hp5w-3hxx-vmwf

More information

Details

Impact

A vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset.

Users are affected if:

• They are using Payload version < v3.79.1 with any auth-enabled collection using the built-in forgot-password functionality.

Patches

Input validation and URL construction in the password recovery flow have been hardened.

Users should upgrade to v3.79.1 or later.

Workarounds

There are no complete workarounds. Upgrading to v3.79.1 is recommended.

Severity

• CVSS Score: 9.1 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

• https://github.com/payloadcms/payload/security/advisories/GHSA-hp5w-3hxx-vmwf
• https://github.com/payloadcms/payload/releases/tag/v3.79.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-34751
• https://github.com/advisories/GHSA-hp5w-3hxx-vmwf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Payload has an SQL Injection via Query Handling

CVE-2026-34747 / GHSA-7xxh-373w-35vg

More information

Details

Impact

Certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections.

Patches

This issue has been fixed in v3.79.1 and later. Query input validation has been hardened.

Upgrade to v3.79.1 or later.

Workarounds

Until developers can upgrade:

• Limit access to endpoints that accept dynamic query inputs to trusted users only.
• Validate or sanitize input from untrusted clients before sending it to query endpoints.

Severity

• CVSS Score: 8.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

References

• https://github.com/payloadcms/payload/security/advisories/GHSA-7xxh-373w-35vg
• https://nvd.nist.gov/vuln/detail/CVE-2026-34747
• https://github.com/payloadcms/payload/releases/tag/v3.79.1
• https://github.com/advisories/GHSA-7xxh-373w-35vg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Payload has Authenticated SSRF via Upload Functionality

CVE-2026-34746 / GHSA-6r7f-q7f5-wpx8

More information

Details

Impact

An authenticated Server-Side Request Forgery (SSRF) vulnerability existed in the upload functionality.

Authenticated users with create or update access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs.

Consumers are affected if ALL of these are true:

• Payload version < v3.79.1
• At least one collection with upload enabled
• An authenticated user has create or update access to that collection

Patches

This vulnerability has been patched in v3.79.1. Users should upgrade to v3.79.1 or later.

Workarounds

Until consumers can upgrade:

• Restrict create and update access to upload-enabled collections to trusted roles only.
• Limit outbound network access from your Payload server where possible.

Severity

• CVSS Score: 7.7 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

• https://github.com/payloadcms/payload/security/advisories/GHSA-6r7f-q7f5-wpx8
• https://nvd.nist.gov/vuln/detail/CVE-2026-34746
• https://github.com/payloadcms/payload/releases/tag/v3.79.1
• https://github.com/advisories/GHSA-6r7f-q7f5-wpx8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Payload has a CSRF Protection Bypass in Authentication Flow

CVE-2026-34749 / GHSA-p6mr-xf3r-ghq4

More information

Details

Impact

A Cross-Site Request Forgery (CSRF) vulnerability existed in the authentication flow. Under certain conditions, the configured CSRF protection could be bypassed, allowing cross-site requests to be made.

Consumers are affected if ALL of these are true:

• Payload version < v3.79.1
• serverURL is configured

Patches

This vulnerability has been patched in v3.79.1. Additional validation has been added to the authentication flow.

Consumers should upgrade to v3.79.1 or later.

Workarounds

There is no complete workaround without upgrading.

If consumers cannot upgrade immediately, setting cookies.sameSite to 'Strict' will prevent the session cookie from being sent cross-site. However, this will also require users to re-authenticate when navigating to the application from external links (e.g. email, other sites).

Severity

• CVSS Score: 5.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

References

• https://github.com/payloadcms/payload/security/advisories/GHSA-p6mr-xf3r-ghq4
• https://nvd.nist.gov/vuln/detail/CVE-2026-34749
• https://github.com/payloadcms/payload/releases/tag/v3.79.1
• https://github.com/advisories/GHSA-p6mr-xf3r-ghq4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Payload: Sort queries could expose protected field information

CVE-2026-105805 / GHSA-9g87-32v6-3c2r

More information

Details

Impact

Under certain conditions, sorting readable records could reveal limited information about fields the requester was not permitted to read.

You are affected if untrusted users can query a collection, control its sorting, and sort by protected fields.

Patches

Payload now applies field-level access checks to sort fields before executing queries.

Users should upgrade to >= 3.88.0 or >= 4.0.0-canary.27.

Workarounds

Upgrading is recommended. Until then, prevent untrusted users from controlling sort parameters or restrict their access to affected collections.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/payloadcms/payload/security/advisories/GHSA-9g87-32v6-3c2r
• https://github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a
• https://github.com/payloadcms/payload/releases/tag/v3.88.0
• https://github.com/advisories/GHSA-9g87-32v6-3c2r

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Payload relationship-query authorization bypass

CVE-2026-105852 / GHSA-7c34-32v3-j575

More information

Details

Impact

A readable collection could expose information about protected documents in a related collection.

You are affected if:

• You expose a readable collection with a relationship to a collection protected by access.read where constraints.

Patches

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Workarounds

There is no complete workaround. Upgrade Payload packages >= 3.90.0 or >= 4.0.0-canary.34.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/payloadcms/payload/security/advisories/GHSA-7c34-32v3-j575
• https://github.com/payloadcms/payload/commit/94059cf4bc6170ce88453015c0c6551329ae3982
• https://github.com/payloadcms/payload/releases/tag/v3.90.0
• https://github.com/advisories/GHSA-7c34-32v3-j575

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Payload didn't enforce field-level password update restrictions

CVE-2026-105855 / GHSA-fx49-4h83-wjv9

More information

Details

Impact

When an auth collection defined a field-level access.update restriction on the password field, the restriction was not enforced on the server correctly.

Patches

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Severity

• CVSS Score: 7.6 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/payloadcms/payload/security/advisories/GHSA-fx49-4h83-wjv9
• https://github.com/payloadcms/payload/commit/9de9e7911e29d60870a1d5480412524c63d6411e
• https://github.com/payloadcms/payload/releases/tag/v3.90.0
• https://github.com/advisories/GHSA-fx49-4h83-wjv9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Payload: Unauthorized update to collection documents

CVE-2026-105859 / GHSA-f7hx-52q9-hcrf

More information

Details

Impact

An attacker can submit a request to a specific endpoint that permits collection documents to be updated regardless of access control and field level access control.

You are affected if:

• You are configuring orderable: true with any collection or join field.

Patches

In the patched version access control is properly enforced.

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Severity

• CVSS Score: 9.8 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://github.com/payloadcms/payload/security/advisories/GHSA-f7hx-52q9-hcrf
• https://nvd.nist.gov/vuln/detail/CVE-2026-105859
• https://github.com/payloadcms/payload/commit/36fa9af73dd04fa59f4b4a06d11454538c4c1409
• https://github.com/payloadcms/payload/releases/tag/v3.90.0
• https://github.com/advisories/GHSA-f7hx-52q9-hcrf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Payload: Uploaded XML files could execute same-origin JavaScript

CVE-2026-105868 / GHSA-9qpg-3cf8-w33x

More information

Details

Impact

Under certain local upload configurations, an uploaded XML file and stylesheet could execute JavaScript in the Payload origin when a logged-in user opens the file.

You are affected if:

• You accept XML uploads (accepted by default).

Patches

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Workarounds

Disallow XML/XSL uploads.

Severity

• CVSS Score: 8.6 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/payloadcms/payload/security/advisories/GHSA-9qpg-3cf8-w33x
• https://nvd.nist.gov/vuln/detail/CVE-2026-105868
• https://github.com/payloadcms/payload/commit/a8c3a8e8e2680c96ec4f66f5b3854c5df6c35adf
• https://github.com/payloadcms/payload/releases/tag/v3.90.0
• https://github.com/advisories/GHSA-9qpg-3cf8-w33x

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Payload: Unauthenticated account-lockout denial of service

CVE-2026-105866 / GHSA-v5gf-vpjc-pc7w

More information

Details

Impact

An unauthenticated attacker who knows an account’s email address or username could trigger Payload’s account lockout mechanism and prevent that user from signing in.

You are affected if:

• Using an affected Payload version with an auth-enabled collection that uses local authentication and account lockout.

Applications that do not use Payload local authentication are not affected.

Patches

Successful password resets now clear the account’s lockout state. The forgot-password flow also enforces a configurable minimum interval between reset emails, which defaults to 15 seconds.

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/payloadcms/payload/security/advisories/GHSA-v5gf-vpjc-pc7w
• https://nvd.nist.gov/vuln/detail/CVE-2026-105866
• https://github.com/payloadcms/payload/commit/1c46204a73a0a9f988a80c52690eee5a4ada3cf1
• https://github.com/payloadcms/payload/releases/tag/v3.90.0
• https://github.com/advisories/GHSA-v5gf-vpjc-pc7w

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Payload: Incomplete validation during the upload file lifecycle

CVE-2026-105865 / GHSA-p223-2wr2-j562

More information

Details

Impact

Under certain conditions, an authenticated user with permission to modify uploads could cause unintended files to be removed during file cleanup. This may result in data loss or service disruption.

You are affected if:

• You use Payload upload collections with local file storage.
• Untrusted authenticated users can update or delete uploads.

Deployments that restrict upload management to trusted users are less exposed.

Patches

Payload now validates uploaded filenames and ensures file cleanup remains within the configured upload directory.

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Workarounds

Restrict upload update and deletion operations to trusted users and validate submitted filenames. These measures are temporary mitigations. Upgrading to a patched version is recommended.

Severity

• CVSS Score: 8.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

References

• https://github.com/payloadcms/payload/security/advisories/GHSA-p223-2wr2-j562
• https://nvd.nist.gov/vuln/detail/CVE-2026-105865
• https://github.com/payloadcms/payload/commit/6b74418f628fa633c2f297e5919a9f91b383dc11
• https://github.com/payloadcms/payload/releases/tag/v3.90.0
• https://github.com/advisories/GHSA-p223-2wr2-j562

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Payload: Bypassed sanitization of user uploaded SVGs

CVE-2026-105862 / GHSA-2pwp-2369-8fg3

More information

Details

Impact

A malicious SVG file upload could bypass sanitization, be stored, and execute attacker-controlled JavaScript (XSS) after a user downloads it and opens it.

You are affected if:

• You have a collection configured to upload and allow SVG files which can then be downloaded by users.

Patches

The fix validates SVG content on every upload path and hardens SVG/XML delivery so stored SVGs cannot frame attacker content.

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Workarounds

Disallow SVG uploads, or serve uploaded SVGs as downloads with Content-Disposition: attachment and a strict CSP. These mitigations reduce exposure but do not replace upgrading when the patched release is available.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

References

• https://github.com/payloadcms/payload/security/advisories/GHSA-2pwp-2369-8fg3
• https://nvd.nist.gov/vuln/detail/CVE-2026-105862
• https://github.com/payloadcms/payload/commit/a8c3a8e8e2680c96ec4f66f5b3854c5df6c35adf
• https://github.com/payloadcms/payload/releases/tag/v3.90.0
• https://github.com/advisories/GHSA-2pwp-2369-8fg3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Payload: Remote Code Execution through first-register

CVE-2026-105858 / GHSA-97rh-rhh2-7vjv

More information

Details

Impact

A crafted request to the public first-register operation can be used to perform a RCE exploit.

You are affected if:

• You use local auth strategy and your application remains without an initial user created

Patches

In the patched version data submission to create first user is properly sanitized.

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Severity

• CVSS Score: 8.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://github.com/payloadcms/payload/security/advisories/GHSA-97rh-rhh2-7vjv
• https://nvd.nist.gov/vuln/detail/CVE-2026-105858
• https://github.com/payloadcms/payload/commit/e947fc4ba4a434f276d043386e501b1d14eda679
• https://github.com/payloadcms/payload/releases/tag/v3.90.0
• https://github.com/advisories/GHSA-97rh-rhh2-7vjv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

payloadcms/payload (payload)

v3.90.0

Compare Source

⚠️ This release contains a set of critical security fixes. Please review the following notes and upgrade as soon as possible. Even if none of the listed items below affect you, we still recommend updating as soon as possible.

These notes only cover the behavior, configuration, and API-surface changes that projects may need to react to when upgrading. Exploit details, attack surface descriptions, and severity are intentionally omitted.

CVE and GHSA identifiers for the underlying issues are published separately.

How to read this document

Every entry has: Affected if you (concrete conditions - if none apply, no action is required), and Action required.

After upgrading:

• Regenerate your payload types: pnpm payload generate:types
• If you are using a relational database, you will need to create and run a migration:

pnpm payload migrate:create <migration-name>
pnpm payload migrate

Password changes now revoke other sessions

• No action needed.

Password reset now clears lockouts; forgot-password is throttled

• Adds new resetPasswordRequestedAt field to user collections

• Action required:

  • Regenerate types: pnpm payload generate:types
  • If using a relational database, perform migration:

pnpm payload migrate:create add-reset-password-requested-at
pnpm payload migrate

Scheduled publishing preserves the scheduling user's auth collection

Affected if you:

• Have publish or unpublish events queued when upgrading.
• Use multiple admin-capable auth collections.
• Queue schedulePublish jobs directly or depend on its generated task types.

Action required:

• Re-create pending scheduled publish and unpublish events after upgrading.
• Update custom queue code to pass user: { relationTo, value } (value is user ID).
• Regenerate committed Payload types if applicable.
• No database migration is required.

Stricter validation for SVG and XML uploads

Affected if you:

• Upload SVG, XHTML, or XML-family files.
• Use direct client uploads, particularly with Azure or a custom integration.
• Depend on path components being retained in new filenames.

Action required:

• Verify affected upload and XML-delivery workflows.
• Ensure custom upload clients send the required metadata and returned headers.
• Set allowRestrictedFileTypes: true in the collections upload property if the previous behavior is explicitly required.

Client uploads hardened across all adapters

Affected if you:

• Use any client upload adapters with clientUploads: true (S3, GCS, Azure, or custom).

Action required:

• If using GCS adapter, add x-goog-if-generation-match header to GCS CORS allowed headers.

Azure containers default to private

Affected if you:

• Use the @payloadcms/storage-azure adapter with allowContainerCreate: true

Action required:

• If you wish to retain the previous behavior, set containerAccess: 'blob' in your Azure storage config.

Client uploads are stored in a per-upload folder

Affected if you:

• Use clientUploads with a storage adapter and access stored files outside Payload (for example, by building paths from prefix and filename)
• Set document prefix values outside the adapter's collection prefix

What changed:

• New client uploads are stored at <prefix>/<_objectKey>/<filename>, including generated image sizes. _objectKey is a new field on upload collections. Existing files are not moved.
• New uploads and replacements are always stored inside the collection prefix. For example, a document prefix of user-123 with collection prefix media is stored under media/user-123/.

Action required:

• Include _objectKey (when set) between the prefix and filename when building storage paths outside Payload.
• If using a relational database, the migration from the "After upgrading" step adds the _objectKey column.

disablePayloadAccessControl no longer disables safe outbound fetch

Affected if you:

• Set disableAccessControl: true in your Payload config.

Action required:

• Configure a narrow upload.skipSafeFetch allowlist for trusted destinations
• Use skipSafeFetch: true only when every URL accepted by the collection is trusted.
• No action is required when files are retrieved from ordinary public endpoints.

External file fetches require a trusted origin

Affected if you:

• Use upload.disableLocalStorage: true and rely on Payload fetching relative URLs whose endpoint requires a Payload session cookie.
• Implement externalFileHeaderFilter, particularly if it assumes it runs only once.
• Use non-HTTP(S) external-file URLs.

Action required:

• Configure serverURL or add the exact application origin to your CORS or CSRF configuration.
• Replace non-HTTP(S) external-file URLs with HTTP(S) URLs.
• Review externalFileHeaderFilter and use the optional context when headers need to vary by destination.

upload: {
  externalFileHeaderFilter: (headers, context) => {
+   if (!context?.isSameOrigin) {
+     delete headers.cookie
+     delete headers.authorization
+   }
+
    return headers
  },
}

Uploaded filename hardening

Affected if you:

• Use a custom top-level prefix field on an upload collection as ordinary application data.
• Change an upload’s storage prefix without also replacing its file.

Action required:

• Rename a custom, non-storage prefix field or update it through trusted server-side code.
• Submit storage-prefix changes as part of a file replacement. Adapter-managed prefix fields do not require migration.

Multipart uploads are now capped at 50MB by default

Affected if you:

• Use multipart uploads and rely on uploads being larger than 50MB

Action required:

• Raise the multipart cap if your application requires support for larger uploads for requests. Adjust the requestSizeLimit in your Payload config:

upload {
+  requestSizeLimit: 75 * 1024 * 1024, // Example 75 MiB for the complete multipart request
}

Form Builder defaults form submission read access to the admin collection

Affected if you:

• Have more than one auth enabled where the secondary auth collections are expected to be able to read either:
  • form-submission docs
  • forms.emails array field

Action required:

• Supply an explicit formSubmissionOverrides.access or formOverrides.access to override the new defaults. If you already have overrides configured, they will continue to be respected.

Stricter where validation for polymorphic joins

Polymorphic joins now apply complete where constraints and throw a QueryError when a filter is unsupported.

Unsupported filters include:

• Localized fields.
• Fields nested inside arrays or blocks.
• Paths traversing relationship, upload, or JSON fields, such as owner.email.
• The near, within, intersects, and all operators.
• The same field path having incompatible definitions across joined collections, such as number in one collection and text in another.

Affected if you:

• Use a join whose collection references multiple collections, and
• Apply an unsupported filter through:
  • A target collection's read access rule.
  • A join where constraint.
  • An Admin baseFilter or baseListFilter used by folder browsing.
• Use folders with folder-enabled collections whose read access or base filters contain one of these unsupported shapes.

Action required:

• Review where constraints and read access rules for every collection referenced by a polymorphic join.
• If using folders, review every folder-enabled collection's read access rules and Admin base filters.
• Rewrite unsupported filters to use direct, compatible fields while preserving the intended access restrictions.

API keys are no longer readable after initial generation through UI or within Payload operations

If you wish to retain old behavior, set the following in your config:

auth: {
-  useAPIKey: true,
+  useAPIKey: {
+    reveal: true,
+  },
 }

Lexical version bump

Full Details

No application changes or data migration are needed when using Payload's built-in rich text features.

If you maintain custom rich text features, check that they still compile and that custom content loads, copies, and pastes correctly. Lexical removed some older APIs, tightened TypeScript types, and changed how custom nodes are loaded and copied. Tests that inspect the editor's HTML may also need updated selectors or snapshots because Lexical adds some internal markup.

Do not install lexical or @​lexical/* yourself for use with Payload. Remove any direct dependencies you added for the editor and use Payload's re-exports from @payloadcms/richtext-lexical/lexical and @payloadcms/richtext-lexical/lexical/*. Payload supplies the matching versions; mixing versions can break the editor. This is the existing custom feature requirement.

v3.89.0

Compare Source

🚀 Features

• ui: add warning type to Banner (#​17750) (6e5f386)

🐛 Bug Fixes

• avoid buffering large client uploads into memory (#​17872) (e896688)
• "No client field found for ..." 500 error in version diff (#​18001) (88f0622)
• upgrade next to 16.3.3 across core and templates (#​17933) (24164d8)
• db-mongodb: avoid unnecessary aggregation when no joins are selected (#​17785) (9a309af)
• drizzle: preserve omitted hasMany selects (#​18085) (ee7c00c)
• drizzle: warn on truncated identifiers, throw on collisions (#​17650) (52c4d70)
• email-resend: http fetch error handling swallows errors (#​17798) (61d3961)
• plugin-form-builder: include autolink nodes in LinkHTMLConverter, v3 backport (#​17788) (5061283)
• ui: handle unsupported preview URLs (#​18136) (112f419)
• ui: add @​swc/helpers direct dependency (#​17893) (ec0e98e)
• ui: prevent render loop during rapid title input (#​17834) (f954804)
• ui: rich text fields not read-only inside tabs on trashed and locked documents 3.x (#​17791) (82f5576)

🛠 Refactors

• improve access defaults for jobs (#​17867) (4379bf0)

📚 Documentation

• add UI component library (#​18093) (4884195)
• clarify pagination limits (#​18095) (2e4806a)
• fix invalid TypeScript examples (#​17995) (79fd084)
• add guide for overriding default fields (#​17926) (1c0c454)
• fix CLAUDE.md path in agent instructions (#​17881) (b48a151)

⚠️ BREAKING CHANGES

• improve access defaults for jobs (#​17867) (4379bf0)

  This backports the v4 jobs access changes to Payload v3.

🤝 Contributors

• Paul (@​paulpopus)
• Jake Fletcher (@​jacobsfletch)
• Sean Zubrickas (@​zubricks)
• Alessio Gravili (@​AlessioGr)
• Nate Lentz (@​nathanlentz)
• Tyler Schwartz (@​tschwartz)
• Fahad Noor (@​FahadNoor)
• Anders Semb Hermansen (@​andershermansen)
• Patrik (@​PatrikKozak)
• Jens Becker (@​jhb-dev)
• Dan Ribbens (@​DanRibbens)
• Jessica Rynkar (@​JessRynkar)

v3.88.0

Compare Source

🐛 Bug Fixes

• prevent multipart content-type backtracking (#​17679) (a742140)
• ui: tighten clipboard prefix matching to prevent sibling row leakage on copy/paste (#​17595) (c6477b8)

🛠 Refactors

• plugin-mcp: better access control defaults for api keys collection (#​17751) (025581d)

📝 Templates

• bump next.js to 16.3.0 (#​17683) (ee155b7)

🤝 Contributors

• Jarrod Flesch (@​JarrodMFlesch)
• Alessio Gravili (@​AlessioGr)
• Nate Lentz (@​nathanlentz)

v3.87.1

Compare Source

🐛 Bug Fixes

• connect to the correct Next.js dev HMR endpoint per version (#​17644) (291ac66)
• db-mongodb: bump mongoose to 8.24.1 for GHSA-664h-wqgq-64gw (3.x backport of #​17609) (#​17608) (f039324)
• deps: bump undici (#​17630) (9e2c11e)
• plugin-mcp: bump @​modelcontextprotocol/sdk to 1.30.0 for GHSA-frvp-7c67-39w9 (3.x) (#​17611) (0cb605d)
• richtext-lexical: preserve link drawer form state (#​17586) (90fb9e1)
• templates: fix with-cloudflare-d1 build and bump dependencies (#​17577) (ca3e899)

📚 Documentation

• update admin panel location link in custom components docs (#​17624) (57178e3)

⚙️ CI

• allow changes job to check out repository (#​17643) (ec4f979)

🤝 Contributors

• Nate Lentz (@​nathanlentz)
• Jarrod Flesch (@​JarrodMFlesch)
• Elliot DeNolf (@​denolfe)
• Sean Zubrickas (@​zubricks)
• Patrik (@​PatrikKozak)

v3.87.0

Compare Source

🚀 Features

• storage-azure: client uploads with chunkLargeFiles can now support files larger than 5gb (#​17319) (3c00a39)

🐛 Bug Fixes

• preserve parent localization through tabs 3.x (#​17591) (9c8d636)
• replace image-size with image-dimensions dependency for upload dimensions (#​17571) (2a99a01)
• forward locale in count and countGlobalVersions (3.x) (#​17547) (e042561)
• pass id to delete access control on soft delete in updateByID (#​17529) (a539f5b)
• prefer draft titles in by folder view (#​17412) (ef8a6a5)
• arrays and blocks should handle null values, v3 backport (#​17278) (2a69863)
• db-mongodb: error on null values in arrays and blocks (#​17190) (249f8df)
• drizzle: validate companion table name length against 63-char limit (#​17563) (fd629f2)
• drizzle: dedupe reused localized block tables (#​17430) (3e8191c)
• plugin-multi-tenant: apply tenant on confirm (#​17350) (09e01df)
• storage-vercel-blob: allow overwriting existing blob keys (#​17385) (fc2572e)
• templates: prevent unauthenticated draft-mode access in website preview route (#​17472) (0c2e9a8)
• templates: mark website button as client component for radix-slot context (#​17474) (981b282)
• ui: resolve named-tab field permissions in bulk edit field select (3.x backport of #​17523) (#​17524) (2371624)
• ui: keep folder create drawers open during autosave (#​17421) (bf72bda)
• ui: handle undefined field admin components (#​17388) (5157c72)

📚 Documentation

• remove deprecated root endpoint property (#​17570) (6402daa)
• accessibility banner fix (#​17431) (29dd43c)
• fix link in live preview dynamic url section (#​17340) (cc81ef0)
• document exported TypeScript type helpers for plugins (#​17336) (d4d029f)
• plugin-mcp: fix broken Claude Code link (#​17502) (21e24ca)

🧪 Tests

• richtext-lexical: create dev user first in seed to fix flaky e2e (3.x backport of #​17507) (#​17568) (0f6c1b3)

⚙️ CI

• remove --json from pnpm publish to fix release hang on pnpm v11 (#​17279) (4a82c20)

🏡 Chores

• export parse params and related sanitizers (#​17314) (f14722a)

🤝 Contributors

• Dan Ribbens (@​DanRibbens)
• Paul (@​paulpopus)
• Patrik ([@

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.